Zot Registry

Zot Registry is an open-source OCI-native registry for teams that run their own infrastructure and need control over storage, authentication, and repository permissions. It is strongest for on-premises environments, including installations alongside Kubernetes. The trade-off is operational responsibility and a compatibility gap for workloads that depend on ORAS artifacts.

Overview

Zot implements OCI Distribution Specification APIs and uses OCI Image Layout for storage, making it suitable for serving and managing container images and other OCI artifacts. It is licensed under Apache 2.0 and identified by its homepage as a CNCF Sandbox Project. The project is aimed at operators who want a registry they can deploy and configure themselves rather than a hosted service with a fixed operating model.

Key features

Deployment is available through full and minimal single-binary builds, and root privileges are not required. The minimal build reduces dependencies and attack surface, while the full container image adds search, vulnerability scanning, synchronization, scrubbing, metrics, a web UI, management, and image-trust extensions. Search, UI, and management are enabled by default, so the full image offers useful administration without requiring every extension to be turned on manually.

Storage supports local filesystems and AWS S3, plus multiple storage paths and backends. Layer deduplication can limit repeated data, garbage collection helps reclaim unused layers, and background scrubbing checks stored data over time. Immutable tags and retention policies provide stronger control over image lifecycle than an ungoverned tag-based workflow.

Authentication covers TLS, mTLS, htpasswd, LDAP, bearer tokens, and OpenID/OAuth2 options. Identity-based policies can limit actions for users or groups at repository or repository-path level, which suits teams sharing one registry across projects. Image security includes vulnerability scanning and signatures through cosign and notation. Integrations named by the project include Helm charts, skopeo, cri-o, and Prometheus metrics.

Operational tooling includes logging, metrics, benchmarking with zb, and performance profiling. Security hardening practices described by the project include PIE builds, non-root deployment, code-owner reviews, and security scans of produced binaries. Native Windows binaries are distributed for amd64 and arm64, although the stated deployment fit remains on-premises. Release notes say ORAS artifact support was removed starting with the listed version, a material limitation for teams relying on that artifact type.

Pricing

Zot Registry costs nothing under the Apache 2.0 open-source project. The plan includes full or minimal builds, with no paid tier or trial requirement. That makes it attractive when your organization can provide the infrastructure and administration; it does not remove the cost of storage, operation, monitoring, or security ownership that comes with self-hosting.

Platforms

Zot is offered for API, Linux, macOS, self-hosted, and web use. Native Windows binaries are also distributed for amd64 and arm64. The combination of single-binary deployment and non-root operation is practical for controlled infrastructure, while teams seeking a managed registry should look elsewhere.

Who it's for

Choose Zot when you need an OCI-compatible registry on premises, configurable storage, repository-level policies, and integrated scanning and signing support. It is particularly appropriate for platform and security teams operating alongside Kubernetes, or for organizations that need local filesystem or S3 choices. It is a weaker fit if you require ORAS artifacts in the supported release, prefer a hosted service, or do not want to maintain registry infrastructure.

Pros and cons

• Pros: Apache 2.0 licensing and a free distribution avoid per-seat software charges.
• Pros: Full and minimal binaries, non-root deployment, and hardening measures support different security and operational constraints.
• Pros: Local and S3 storage, deduplication, garbage collection, scrubbing, immutable tags, and retention policies give administrators meaningful lifecycle control.
• Pros: Broad authentication, identity-based policies, vulnerability scanning, cosign and notation signatures, and Prometheus metrics cover security and operations in one registry.
• Cons: Self-hosting leaves infrastructure, storage, upgrades, and monitoring responsibilities with your team.
• Cons: ORAS artifact support was removed starting with the stated version, which can exclude workflows built around those artifacts.
• Cons: Zot is described as currently suited to on-premises deployments, so it is not the obvious choice for organizations seeking a primarily hosted experience.

Alternatives

Container Registries is the broader category guide for comparing registry options.

• Docker Desktop is a better fit when you want a freemium desktop stack across Linux, macOS, web, and Windows, with a free Personal plan and a paid Pro tier.
• Inedo ProGet suits teams wanting a freemium self-hosted registry with a free edition, unlimited private Docker feeds, and a free trial.
• JFrog Container Registry is preferable for a free self-managed edition covering Docker, OCI, Helm, Helm OCI, and Generic formats, with a free trial; its listed edition has no Xray.
• KakaoCloud Container Registry fits users wanting a service with a free 30 GiB outbound allowance and usage-based KRW charges beyond it.
• 8gears Container Registry offers a free-forever Individuals plan with 1 GB storage, unlimited private repositories, and community support.
• Chainguard Registry is an option for teams seeking free images with up to five images per organization.
• Cosmoner Container Registry may suit users who want image uploads without a charge and metered egress pricing.
• lazer.sh targets hosted users who need defined storage, project, member, and repository allowances on a paid Hobby plan.

Verdict

Choose Zot Registry if your priority is a capable, standards-based registry that you can run on your own infrastructure with fine-grained access, storage, and image-security controls. Look elsewhere if you need ORAS artifacts, a managed service, or a product that shifts day-to-day registry operations away from your team.